search cancel

Install or Upgrade of legacy DLP Agent causes restart of existing Altiris Agent


Article ID: 163822


Updated On:


IT Management Suite


Customers installing a recent version of the DLP Agent (12.5 and later) find that their Symantec Management Agent process (aka Altiris Agent, aexnsagent.exe) is restarted during the DLP Agent install.

This is true even if the customer never used Symantec Management Platform (aka Notification Server) in concert with Symantec DLP Agents.

Stop and start of the DLP Altiris Agent action is recorded in MSI log:

MSI (s) (0C:60) [15:41:25:932]: Doing action: StopAltirisAgent
Action ended 15:41:25: SetServiceNamesFromRegistry. Return value 1.
MSI (s) (0C:60) [15:41:25:932]: Note: 1: 2235 2:  3: ExtendedType 4: SELECT `Action`,`Type`,`Source`,`Target`, NULL, `ExtendedType` FROM `CustomAction` WHERE `Action` = 'StopAltirisAgent'
MSI (s) (0C:B4) [15:41:25:932]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI4B84.tmp, Entrypoint: StopAltirisAgent
Action start 15:41:25: StopAltirisAgent.


Action start 15:41:42: StartAltirisAgent.
2016-10-10 15:41:42 | StartAltirisAgent | INFO | MSI VersionNT property: 601, MSI WindowsBuild property: 7601, MSI MsiNTProductType property: 1
2016-10-10 15:41:42 | StartAltirisAgent | INFO | Is OS Windows 7 or Higher: 1
2016-10-10 15:41:42 | StartAltirisAgent | INFO | Inside True64 process
2016-10-10 15:41:42 | StartAltirisAgent | INFO | ExecAndWait(): Waiting for process to finish...
2016-10-10 15:41:46 | StartAltirisAgent | INFO | ExecAndWait(): Process finished with exit code 0.
2016-10-10 15:41:46 | StartAltirisAgent | INFO | execAndWait("AexAgentUtil /start") ok
MSI (s) (0C:60) [15:41:46:010]: Doing action: RemoveFolders
Action ended 15:41:46: StartAltirisAgent. Return value 1.


When installing or upgrading version 12.5 or later of the DLP Endpoint Agent, any previous versions of DLP Agent will be uninstalled when found:

InstallShield 15:41:20: Getting records from Upgrade table
InstallShield 15:41:20: UpgradeCode: {F8D8827A-4C61-4956-866C-E66A6B30E0A2}    MinVersion:    MaxVersion:     Language:     Attributes: 2
InstallShield 15:41:20: Checking related product {2AF3B399-42A5-42bd-A5E0-72B657110363}
MSI (s) (0C!7C) [15:41:20:473]: PROPERTY CHANGE: Adding IS_MAJOR_UPGRADE property. Its value is 'Yes'.
InstallShield 15:41:20:     AgentInstall64    {2AF3B399-42A5-42bd-A5E0-72B657110363}    1033    11.5.1000.06038     ***Related***
InstallShield 15:41:20: ALLUSERS of related product {2AF3B399-42A5-42bd-A5E0-72B657110363} is = 1


Symantec DLP used to have an Integration Component that allowed DLP Endpoint Agents to be managed by the Symantec Management Platform (v7.1 and earlier).

Thus, by default, DLP Endpoint Agent versions 12.0 and earlier registered on install with the Management Agent if present. In addition, the Management Agent is stopped and restarted by the DLP MSI process.


This is expected behavior, and as long as the process is successfully restarted, should not result in any problems with the Management Agent.